Base64URL decode, padding and all.

Standard Base64 uses + and /, which mean something in URLs and file names, and pads with =, which has to be percent-encoded in a query string. Base64URL, defined in RFC 4648 section 5, swaps just those characters so the value can travel in a URL untouched:

The other 62 characters are identical, so converting is a simple character swap plus padding.

Many strict decoders reject unpadded input. The rule for putting the padding back depends only on the length of the string modulo 4:

• remainder 0 — no padding needed;
• remainder 2 — add ==;
• remainder 3 — add =;
• remainder 1 — impossible in valid Base64: the value is truncated.

This decoder applies the rule for you and reports a truncated value instead of silently returning garbage.

• JSON Web Tokens — the header, payload and signature are three base64url segments joined by dots. The signature is shown but not verified, since that needs the key.
• WebAuthn and passkeys — challenges, credential IDs and client data.
• OAuth PKCE — the code_challenge is a base64url SHA-256 digest.
• Gmail API — message bodies and attachments are base64url encoded.
• Short IDs and tokens in URLs, cookies and file names.

# Python: urlsafe_b64decode still needs the padding back
import base64
def b64url_decode(s: str) -> bytes:
    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))

// Node.js 16+
Buffer.from(token, "base64url").toString("utf8");

// Go
base64.RawURLEncoding.DecodeString(s)

// Java 8+: the URL decoder accepts unpadded input
Base64.getUrlDecoder().decode(s);

For standard Base64 and more languages, see the main Base64 decode page.